Canada Updates: Quebec’s Bill 64 & IAB TCF Policies

There have recently been major developments out of Canada related to privacy rights and consent. Starting with Quebec’s Bill 64, which received a majority vote on September 21, 2021, in the National Assembly of Quebec 14 months after it was introduced. The purpose of the bill was to modernize the current legal requirements in Quebec related to the protection of personal data and information. Bill 64 not only updates the current legal framework for users’ personal data and privacy rights but also harmonizes Quebec’s privacy laws with those of other jurisdictions. Many of the proposed amendments were influenced by other global privacy laws such as the Personal Information Protection and Electronics Act (“PIPEDA“) and the European Union’s General Data Protection Regulation (“GDPR“). Ultimately, Bill 64 will enter into effect within three years but the first set of provisions starting 12 months after the date of assent.

Bill 64 Three-Year Entry Requirements

Bill 64 will require many new provisions into Quebec’s existing privacy legislation across three years from the date of assent. This allows organizations time to prepare and align their privacy programs with the new requirements so they can avoid new outlined penalties.

First Year

Provisions entering into effect after one year:

• required to appoint a privacy officer
• right for organizations to disclose personal information without consent when it is necessary for the fulfilment of a commercial transaction or scientific purpose

Second Year

Provisions entering into effect after two years:

• required to inform data subjects about the use of automated decision-making and profiling technologies
• adhere to enhanced consent requirements including clear, free, and informed consent for a specified purpose and timeframe
• required to provide an external privacy policy in clear, plain language
• required to destroy or anonymize personal information once the original purpose has been fulfilled
• provide data subjects the right to restrict processing and the right to erasure

Third Year

Provisions entering into effect after three years:

• must offer data subjects the right to data portability

Bill 64 New Penalties

On top of the new provisions outlined above, Bill 64 will also introduce new monetary penalties of up to CAD 50,000 (approx. €33,330) for individuals. Organizations will now be subject to penalties up to CAD 10,000,000 (approx. €6,667,950) or 2% of worldwide turnover for the preceding year, whichever is greater. Additionally, the CAI will have the power to launch penal proceedings with a maximum penalty of CAD 10,000 (approx. €66,660) in the case of a natural person and CAD 25,000,000 (approx. €16,667,130) or 4% of worldwide turnover for the preceding fiscal year (whichever is greater) in all cases. In the event of a subsequent offense, the fines will double.

Bill 64 will also provide a right of action for individuals who have suffered injury as a result of a violation of the rights introduced by Bill 64. The court can award damages of at least CAD 1,000 (approx. €670).

IAB Canada Finalized TCF Policies

The Interactive Advertising Bureau (IAB) of Canada recently finalized its version of Transparency Consent Framework (TCF) Policies. The TCF consists of a set of technical specifications and policies for publishers, advertisers, technology providers, and others who may voluntarily choose to adhere. The goal of the framework is to help websites in the online digital ecosystem become compliant with Canadian Privacy Law. As a not-for-profit association, IAB Canada represents over 250 of Canada’s most respected advertisers, ad agencies, media companies, service providers, educational institutions, and government associations.

The Framework provides a way of informing and providing choices to users about how their personal information is collected, used, or disclosed for purposes that companies are seeking. Verified CMPs are able to send the user’s choices downstream to participating ad tech vendors.

CookiePro Can Help

To learn more about Canada Bill 64 and how CookiePro can help you comply, request a personalized demo with our team today.